Why docker exec command can launch shell with nologin user?

Question

I have a nologin user for example foo in my /etc/passwd file:

foo:x:1010:1010::/home/foo:/usr/sbin/nologin

After I run this docker container, then I execute the command:

docker exec -it --user foo <container name> bash

It can actually login as foo, do I understand wrong? because from nologin man page, it says:

nologin displays a message that an account is not available and exits
non-zero.  It is intended as a replacement shell field to deny login
access to an account.

How can here docker exec with user foo work?

Answer 1

docker exec is just starting a process in an existing namespace. You aren’t logging into the container, just invoking a command owned by a certain user. Docker doesn’t start the login process if you just tell it to run bash.

To get a fully working login process in docker you’d need to run some sort of login service, such as ssh, mgetty, gdm, or just plainlogin foo. In most cases, it would run through the PAM stack, and pam_unix would read the pwent and the login would fail to start a session.